Define and implement HLF Dynamics webhook payload contract

Define a `WebhookPayload` Dart class with `toJson()` / `fromJson()` using `json_serializable`. The HMAC signing should be encapsulated in a `WebhookSigner` utility class that takes the raw body bytes and the secret, returning the hex-encoded HMAC-SHA256 digest. For Deno Edge Functions, use the built-in `crypto.subtle.sign()` with HMAC-SHA256. The `cert_notification_log` table needs a unique index on `event_id` to enforce idempotency at the database level (not just application level) — this prevents race conditions on concurrent delivery.

Use `INSERT ... ON CONFLICT (event_id) DO NOTHING` and check `rowsAffected` to detect duplicates. The `renewal_history_snapshot` should be computed at serialisation time by sorting renewal records by `issued_at` descending and taking the first 5. Keep the webhook payload schema in a shared Dart model file so both the Edge Function and any Flutter-side preview code use the same definition.

Unit tests with flutter_test covering: correct JSON serialisation of all payload fields including ISO 8601 dates, HMAC signature generation produces consistent output for identical inputs, duplicate event_id lookup returns early without DB write, invalid signature → 401 response, missing signature header → 401 response, renewal_history_snapshot truncated to 5 entries when source has more. Integration test against sandbox: end-to-end outbound webhook delivery with valid signature accepted by Dynamics sandbox, inbound webhook from Dynamics sandbox processed and logged. Test the constant-time comparison to ensure it handles both valid and invalid signatures without timing variance.